I've been diagnosing for the past day or so some issues with an Exchange 2019 server related to Antimalware filtering/scanning. This was disabled on our server, I enabled it, and restarted the transport service per the Microsoft docs:
In Event Viewer, however, we're getting some logs that indicate this isn't working:
Event 6031, FIPFS: MS Filtering Engine Update process has successfully downloaded updates for Microsoft.
Event 6034, FIPFS: MS Filtering Engine Update process is testing the Microsoft scan engine update
Event 6035, FIPFS: MS Filtering Engine Update process was unsuccessful in testing an engine update.
Engine: Microsoft
It looks like it fails for some reason and logs "MS Filtering Engine Update process was unsuccessful in testing an engine update."
Then the process repeats and we can see it trying again:
Event 7003, FIPFS: MS Filtering Engine Update process has successfully scheduled all update jobs.
Event 6024, FIPFS: MS Filtering Engine Update process is checking for new engine updates.
Scan Engine: Microsoft
Update Path: http://amupdatedl.microsoft.com/server/amupdate
Event 6030, FIPFS: MS Filtering Engine Update process is attempting to download a scan engine update.
Scan Engine: Microsoft
Update Path: http://amupdatedl.microsoft.com/server/amupdate.
Event 6031, FIPFS: MS Filtering Engine Update process has successfully downloaded updates for Microsoft.
Event 6034, FIPFS: MS Filtering Engine Update process is testing the Microsoft scan engine update
Event 6035, FIPFS: MS Filtering Engine Update process was unsuccessful in testing an engine update.
Engine: Microsoft
The configuration settings look fine and we've allowed both amupdatedl.microsoft.com and forefrontdl.microsoft.com through the firewall. (It appears that's working because it says downloaded successfully in the Event Viewer logs.)
Any ideas / help would be much appreciated! Thank you!
Edit: One other note, it does seem to be trying to download and use some of the scan engine updates as evidenced by this staging folder here with recent timestamps.
I also found some other resources that suggested a permissions issue, but I checked and Network Service has full permissions to E:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Data
Things I've looked at:
